Pass the Ticket Attack allows attackers to sign in using the victim's Kerberos ticket on other computers.

Pass the Ticket Attack allows attackers to sign in using the victim's Kerberos ticket on other computers.

• A. Mimikatz
• B. Pass the Ticket Attack
• C. AS-REP Roasting
• D. LLMNR/NBT-NS Poisoning

Answer: (B)

Pass-the-ticket is about using a valid Kerberos ticket from a compromised host to authenticate on other machines without re-entering a password. In Kerberos, after you authenticate, you obtain tickets (like a TGT) to request access to services. If an attacker steals that ticket from memory or from a credential cache, they can present it on another computer and gain access to the same services as the original user. This lets the attacker move laterally within a network without cracking passwords, until the ticket expires. Tools such as Mimikatz can help extract tickets, but the technique itself is about reusing the ticket to authenticate. This is distinct from AS-REP roasting (offline cracking of AS-REP responses) and from LLMNR/NBT-NS poisoning (credential capture through network poisoning).

Pass-the-ticket is about using a valid Kerberos ticket from a compromised host to authenticate on other machines without re-entering a password. In Kerberos, after you authenticate, you obtain tickets (like a TGT) to request access to services. If an attacker steals that ticket from memory or from a credential cache, they can present it on another computer and gain access to the same services as the original user. This lets the attacker move laterally within a network without cracking passwords, until the ticket expires. Tools such as Mimikatz can help extract tickets, but the technique itself is about reusing the ticket to authenticate. This is distinct from AS-REP roasting (offline cracking of AS-REP responses) and from LLMNR/NBT-NS poisoning (credential capture through network poisoning).